initial commit

Author: vanderbr

.github/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: ci
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+jobs:
+  test-build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Test
+        run: pnpm test
+
+      - name: Build
+        run: pnpm build

.github/workflows/publish.yml

@@ -0,0 +1,45 @@
+name: publish
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    if: github.event_name == 'workflow_dispatch' || github.event.release.prerelease == false
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org
+          cache: pnpm
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Test
+        run: pnpm test
+
+      - name: Build
+        run: pnpm build
+
+      - name: Publish
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.gitignore

@@ -137,3 +137,11 @@ dist
 # Vite logs files
 vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
+
+# macOS
+.DS_Store
+**/.DS_Store
+
+# Cloudflare local state
+.wrangler/
+.mf/

README.md

@@ -0,0 +1,35 @@
+# @agecheck/core
+
+[![CI](https://github.com/agecheck/agecheck-core/actions/workflows/ci.yml/badge.svg)](https://github.com/agecheck/agecheck-core/actions/workflows/ci.yml)
+[![Publish](https://github.com/agecheck/agecheck-core/actions/workflows/publish.yml/badge.svg)](https://github.com/agecheck/agecheck-core/actions/workflows/publish.yml)
+
+`@agecheck/core` is the security-critical core used by AgeCheck SDK adapters.
+
+It contains:
+
+- token verification (`verifyAgeToken`)
+- gate policy (`isGateRequired`)
+- signed verification cookie helpers
+- typed domain errors and models
+
+Most hostmasters should use `@agecheck/node` directly. Consume `@agecheck/core` only if you are building a framework adapter or platform integration.
+
+## Install
+
+```bash
+pnpm add @agecheck/core
+```
+
+## Quality gates
+
+```bash
+pnpm typecheck
+pnpm test
+pnpm build
+```
+
+## Notes
+
+- Runtime requirement: Node 20+
+- Module format: ESM + CJS output from `dist/`
+- Versioning and release policy: `/docs/VERSIONING.md`

docs/VERSIONING.md

@@ -0,0 +1,27 @@
+# Versioning and Release Policy
+
+## SemVer policy
+
+`@agecheck/core` follows Semantic Versioning.
+
+- `MAJOR`: breaking API or behavior changes
+- `MINOR`: backward-compatible feature additions
+- `PATCH`: backward-compatible fixes and hardening
+
+## Security-sensitive change policy
+
+Any change that affects verification semantics, issuer trust defaults, cookie format, or session binding behavior must include:
+
+- explicit changelog note
+- test coverage for happy + failure paths
+- review confirmation before publish
+
+## Release checklist
+
+1. `pnpm install --frozen-lockfile`
+2. `pnpm typecheck`
+3. `pnpm test`
+4. `pnpm build`
+5. bump version
+6. tag release
+7. publish from CI workflow

package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@agecheck/core",
+  "version": "0.1.1",
+  "description": "Core verification, policy, and cookie logic for AgeCheck SDKs.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/agecheck/agecheck-core"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --clean",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "jose": "^5.9.6"
+  },
+  "devDependencies": {
+    "@types/node": "^24.5.2",
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.2",
+    "vitest": "^2.1.8"
+  },
+  "packageManager": "pnpm@10.29.2"
+}